Andrew Rybchenko [Mon, 16 Apr 2018 13:24:35 +0000 (14:24 +0100)]
mempool: remove callback to get capabilities
The callback was introduced to let generic code to know octeontx
mempool driver requirements to use single physically contiguous
memory chunk to store all objects and align object address to
total object size. Now these requirements are met using a new
callbacks to calculate required memory chunk size and to populate
objects using provided memory chunk.
These capability flags are not used anywhere else.
Restricting capabilities to flags is not generic and likely to
be insufficient to describe mempool driver features. If required
in the future, API which returns structured information may be
added.
Andrew Rybchenko [Mon, 16 Apr 2018 13:24:34 +0000 (14:24 +0100)]
mempool: add op to populate objects using provided memory
The callback allows to customize how objects are stored in the
memory chunk. Default implementation of the callback which simply
puts objects one by one is available.
Andrew Rybchenko [Mon, 16 Apr 2018 13:24:33 +0000 (14:24 +0100)]
mempool: add op to calculate memory size to be allocated
Size of memory chunk required to populate mempool objects depends
on how objects are stored in the memory. Different mempool drivers
may have different requirements and a new operation allows to
calculate memory size in accordance with driver requirements and
advertise requirements on minimum memory chunk size and alignment
in a generic way.
Andrew Rybchenko [Mon, 16 Apr 2018 13:24:31 +0000 (14:24 +0100)]
mempool: rename flag to control IOVA-contiguous objects
Flag MEMPOOL_F_NO_PHYS_CONTIG is renamed as MEMPOOL_F_NO_IOVA_CONTIG
to follow IO memory contiguous terminology.
MEMPOOL_F_NO_PHYS_CONTIG is kept for backward compatibility and
deprecated.
David Hunt [Mon, 23 Apr 2018 13:09:02 +0000 (14:09 +0100)]
mk: fix make defconfig on FreeBSD
On FreeBSD, make defconfig generates the config as
"defconfig_x86_64-bsdapp-", which does not resolve to any known
config file.
On FreeBSD, we get amd64 out of "uname -m", which was not handled by
the list of checks, but which now resolves to x86_64-native.
Then we run '$CC --version', and use grep -o with the list of known
compilers, and set to either gcc, icc or clang. Grep's '-o' option
returns the matched word rather than the whole line, making the
result easier to use.
The remaining code in the patch then takes ${compiler}, the "uname -m"
output and assembles them all together into a valid freebsd config name,
i.e. "defconfig_x86_64-native-bsdapp-clang".
Fixes: bce6c42c4ad5 ("mk: add sensible default target with defconfig") Cc: stable@dpdk.org Signed-off-by: David Hunt <david.hunt@intel.com> Tested-by: Anatoly Burakov <anatoly.burakov@intel.com>
Jianfeng Tan [Fri, 20 Apr 2018 15:20:12 +0000 (15:20 +0000)]
ipc: fix timeout handling in async
In original implementation, timeout event for an async request
will be ignored. As a result, an async request will never
trigger the action if it cannot receive any reply any more.
We fix this by counting timeout as a processed reply.
gettimeofday() returning a negative value is highly unlikely,
but if it ever happens, we will exit without unlocking the mutex.
Arguably at that point we'll have bigger problems, but fix this
issue anyway.
This also silences (or should silence) a few Coverity false
positives where we used strcpy before (Coverity complained
about not checking buffer size, but source buffers were
always known to be sized correctly).
fbarray stores its data in a shared file, which is not hidden.
This leads to polluting user's HOME directory with visible
files when running DPDK as non-root. Change fbarray to always
create hidden files by default.
Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
Olivier Matz [Mon, 29 Jan 2018 10:29:03 +0000 (11:29 +0100)]
cmdline: standardize conversion of IP address strings
The code to convert IPv4 and IPv6 address strings into a binary format
(inet_ntop) was included in the cmdline library because the DPDK was
historically compiled in environments where the standard inet_ntop()
function is not available. Today, this is not the case and the standard
inet_ntop() can be used.
This patch removes the internal inet_ntop*() functions and their
specific license.
There is a small functional impact: IP addresses like 012.34.56.78
are not valid anymore.
For HMAC algorithms (MD5-HMAC, SHAx-HMAC), the supported
digest sizes are not a fixed value, but a range between
1 and the maximum digest size for those algorithms.
For HMAC algorithms (MD5-HMAC, SHAx-HMAC), the supported
digest sizes are not a fixed value, but a range between
1 and the maximum digest size for those algorithms.
Also setting iv_size as 0.
Pablo de Lara [Thu, 19 Apr 2018 14:55:41 +0000 (15:55 +0100)]
crypto/zuc: batch ops with same transform
The ZUC API to encrypt packets does not require the operations
to share the same key. Currently, the operations were being
batched only when they shared the same key, but this is not needed.
Instead, now operations will be batched based on the transform
(cipher only, auth only...).
Fixes: cf7685d68f00 ("crypto/zuc: add driver for ZUC library") Cc: stable@dpdk.org Signed-off-by: Pablo de Lara <pablo.de.lara.guarch@intel.com> Acked-by: Fiona Trahe <fiona.trahe@intel.com>
Pablo de Lara [Thu, 19 Apr 2018 14:55:40 +0000 (15:55 +0100)]
crypto/zuc: remove unnecessary check
When processing operations, the operation type was being
checked to avoid if it was set to NOT SUPPORTED.
In data path, doing so is not required since that is already
checked when creating the crypto session,
so that case will not ever happen.
Fixes: cf7685d68f00 ("crypto/zuc: add driver for ZUC library") Cc: stable@dpdk.org Signed-off-by: Pablo de Lara <pablo.de.lara.guarch@intel.com> Acked-by: Fiona Trahe <fiona.trahe@intel.com>
Pablo de Lara [Thu, 19 Apr 2018 14:55:39 +0000 (15:55 +0100)]
crypto/zuc: do not set default op status
When crypto operations are allocated from the operation
pool, their status get reset to NOT_PROCESSED.
Therefore, there is no need to set this status again.
Fixes: cf7685d68f00 ("crypto/zuc: add driver for ZUC library") Cc: stable@dpdk.org Signed-off-by: Pablo de Lara <pablo.de.lara.guarch@intel.com> Acked-by: Fiona Trahe <fiona.trahe@intel.com>
Anoob Joseph [Wed, 11 Apr 2018 06:40:45 +0000 (12:10 +0530)]
examples/ipsec-secgw: handle ESN soft limit event
For inline protocol processing, the PMD/device is required to maintain
the ESN. But the application is required to monitor ESN overflow to
initiate SA expiry.
For such cases, application would set the ESN soft limit. An IPsec event
would be raised by rte_eth_event framework, when ESN hits the soft limit
set by the application.
Signed-off-by: Anoob Joseph <anoob.joseph@caviumnetworks.com> Acked-by: Akhil Goyal <akhil.goyal@nxp.com>
Anoob Joseph [Wed, 11 Apr 2018 06:40:44 +0000 (12:10 +0530)]
security: extend userdata for IPsec events
Extending 'userdata' to be used for IPsec events too.
IPsec events would have some metadata which would uniquely identify the
security session for which the event is raised. But application would
need some construct which it can understand. The 'userdata' solves a
similar problem for inline processed inbound traffic. Updating the
documentation to extend the usage of 'userdata'.
Signed-off-by: Anoob Joseph <anoob.joseph@caviumnetworks.com> Acked-by: Akhil Goyal <akhil.goyal@nxp.com>
Anoob Joseph [Wed, 11 Apr 2018 06:40:43 +0000 (12:10 +0530)]
security: add ESN soft limit in config
Adding ESN soft limit in conf. This will be used in case of protocol
offload. Per SA, application could specify for what ESN the security
device need to notify application. In case of eth dev(inline protocol),
rte_eth_event framework would raise an IPsec event.
Signed-off-by: Anoob Joseph <anoob.joseph@caviumnetworks.com> Acked-by: Akhil Goyal <akhil.goyal@nxp.com>
Anoob Joseph [Wed, 11 Apr 2018 06:40:42 +0000 (12:10 +0530)]
ethdev: support inline IPsec events
Adding support for IPsec events in rte_eth_event framework. In inline
IPsec offload, the per packet protocol defined variables, like ESN,
would be managed by PMD. In such cases, PMD would need IPsec events
to notify application about various conditions like, ESN overflow.
Signed-off-by: Anoob Joseph <anoob.joseph@caviumnetworks.com> Acked-by: Akhil Goyal <akhil.goyal@nxp.com> Acked-by: Thomas Monjalon <thomas@monjalon.net>
Anoob Joseph [Mon, 16 Apr 2018 12:23:15 +0000 (17:53 +0530)]
examples/ipsec-secgw: fix usage print
The usage print was not updated when jumbo frames & crypto_dev mask
support was added. Fixing that. Also, the optional arguments were not
properly highlighted in the usage header. This is also fixed.
General cleanup of the usage print was also done to make it look more
cleaner and similar to what is existing in other applications like
l3fwd.
Fixes: bbabfe6e4ee4 ("examples/ipsec_secgw: support jumbo frames") Fixes: 2c68fe791538 ("examples/ipsec-secgw: add cryptodev mask option") Fixes: d299106e8e31 ("examples/ipsec-secgw: add IPsec sample application") Cc: stable@dpdk.org Signed-off-by: Anoob Joseph <anoob.joseph@caviumnetworks.com> Acked-by: Radu Nicolau <radu.nicolau@intel.com>
Jay Zhou [Tue, 17 Apr 2018 09:23:25 +0000 (17:23 +0800)]
test/crypto: add tests for virtio-crypto
Only RTE_CRYPTO_CIPHER_AES_CBC cipher
algorithm are tested as unit test, it is supported both by the
cryptodev-backend-builtin and cryptodev-vhost-user of qemu side.
Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Reviewed-by: Fan Zhang <roy.fan.zhang@intel.com>
Jay Zhou [Tue, 17 Apr 2018 09:23:21 +0000 (17:23 +0800)]
crypto/virtio: support burst enqueue/dequeue
This patch implements the functions of virtio_crypto_pkt_tx_burst()
and virtio_crypto_pkt_rx_burst(). The encryption and decryption requests
are placed in the data queue and are ultimately handled by
the backend crypto accelerators.
Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Reviewed-by: Fan Zhang <roy.fan.zhang@intel.com>
Jay Zhou [Tue, 17 Apr 2018 09:23:20 +0000 (17:23 +0800)]
crypto/virtio: support session related ops
This patch implements session related operations, which includes creating
and destroying the session. For now, it only supports the session-oriented
API implementation. The control queue used to create or destroy sessions
for symmetric algorithms.
Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Reviewed-by: Fan Zhang <roy.fan.zhang@intel.com>
Jay Zhou [Tue, 17 Apr 2018 09:23:19 +0000 (17:23 +0800)]
crypto/virtio: support basic PMD ops
This patch implements the basic operations of virtio crypto PMD, which
includes start, stop, close, information getting, queue setup and
release of the device.
The virtio crypto device has two types of queues, data queue and
control queue. It has one data queue at least and has one and only one
control queue. For example, if a virtio crypto device has N queues,
then [0, N-2] is the data queue index, N-1 is the control
queue index.
Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Reviewed-by: Fan Zhang <roy.fan.zhang@intel.com>
Jay Zhou [Tue, 17 Apr 2018 09:23:18 +0000 (17:23 +0800)]
crypto/virtio: support device init
This patch implements the initialization of the virtio crypto device.
The virtio crypto device conforms to virtio-1.0, so this patch only
supports modern mode operation.
The cryptodev is created at the virtio crypto pci device probing stage.
The function of virtio_crypto_pkt_tx_burst() is used to burst transfer
packets and virtio_crypto_pkt_rx_burst() is used to burst receive packets.
Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Reviewed-by: Fan Zhang <roy.fan.zhang@intel.com>
Jay Zhou [Tue, 17 Apr 2018 09:23:17 +0000 (17:23 +0800)]
crypto/virtio: add virtio crypto PMD
The virtio crypto device is a virtual cryptography device
as well as a kind of virtual hardware accelerator for
virtual machines. The linux kernel virtio-crypto driver
has been merged, and this patch introduces virtio crypto
PMD to achieve better performance.
Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Reviewed-by: Fan Zhang <roy.fan.zhang@intel.com>
The application may want to store private data along with the
rte_cryptodev that is transparent to the rte_cryptodev layer.
For e.g., If an eventdev based application is submitting a
rte_cryptodev_sym_session operation and wants to indicate event
information required to construct a new event that will be
enqueued to eventdev after completion of the rte_cryptodev_sym_session
operation. This patch provides a mechanism for the application
to associate this information with the rte_cryptodev_sym_session session.
The application can set the private data using
rte_cryptodev_sym_session_set_private_data() and retrieve it using
rte_cryptodev_sym_session_get_private_data().
Signed-off-by: Abhinandan Gujjar <abhinandan.gujjar@intel.com> Signed-off-by: Nikhil Rao <nikhil.rao@intel.com> Acked-by: Akhil Goyal <akhil.goyal@nxp.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
The application may want to store private data along with the
rte_crypto_op that is transparent to the rte_cryptodev layer.
For e.g., If an eventdev based application is submitting a
crypto session-less operation and wants to indicate event
information required to construct a new event that will be
enqueued to eventdev after completion of the crypto
operation. This patch provides a mechanism for the application
to associate this information with the rte_crypto_op in
session-less mode.
Signed-off-by: Abhinandan Gujjar <abhinandan.gujjar@intel.com> Signed-off-by: Nikhil Rao <nikhil.rao@intel.com> Acked-by: Akhil Goyal <akhil.goyal@nxp.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
The current code usages the default mempool ops while
creating the mempool for crypto usages. Adding the support
for best_mempool_ops to enable it for devices using
non default mempools.
Signed-off-by: Ashish Jain <ashish.jain@nxp.com> Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
crypto/dpaa_sec: move mempool allocation to config
Currently, the context mempools are allocated during device probe. Thus,
even if the DPAA SEC devices are not used, any application would still
allocate the memory required for working with the contexts.
This patch moves the allocation to configuration time so that when the
CAAM devices are configured, this allocation would be done.
Adding a check to do portal configuration if not already
configured before packet enqueue. This check is only done
during dpaa_sec_attach_sess_q for initial packets,
so this change wont affect the data path and hence performance.
Fixes: e79416d10fa3 ("crypto/dpaa_sec: support multiple sessions per queue pair") Cc: stable@dpdk.org Signed-off-by: Ashish Jain <ashish.jain@nxp.com>
Ravi Kumar [Mon, 19 Mar 2018 12:23:51 +0000 (08:23 -0400)]
crypto/ccp: support CPU based MD5 and SHA2 family
Auth operations can be performed on CPU without offloading
to CCP if CONFIG_RTE_LIBRTE_PMD_CCP_CPU_AUTH is enabled in
DPDK configuration. CCP PMD skip offloading auth operations
to hardware engines and perform them using openssl APIs.
Ravi Kumar [Mon, 19 Mar 2018 12:23:40 +0000 (08:23 -0400)]
crypto/ccp: support burst enqueue/dequeue
Added support for burst oriented data path.
CCP PMD selects appropriate CCP engine available
on the platform and schedule the batch of crypto ops to a
selected hardware queue of the respective crypto engine.
Ravi Kumar [Mon, 19 Mar 2018 12:23:39 +0000 (08:23 -0400)]
crypto/ccp: support queue pair related ops
Added crypto queue pair specific crypto ops callback functions
to setup and manage a CCP crypto queue pair object. CCP PMD
exposes only a single crypto queue pair object and handles the
actual hardware queues underneath.
Ravi Kumar [Mon, 19 Mar 2018 12:23:36 +0000 (08:23 -0400)]
crypto/ccp: support device init
CCP PMD is a virtual crypto PMD which schedules a number of available
actual CCP hardware engines underneath. The PMD
manages all devices by its own. The PMD supports CCP_5a and
CCP_5b versions of crypto engines and this patch adds support
to initialize and use such devices.
Removing redundant strncmp in parsing long arguments. The getopt library
provides means to identify long options using the "val" field of
structure option. The existing code gets 0 as "val" for all long
arguments and then uses strncmp to figure out which long option was
being referred to. Fixing this.
In addition, the macros and enums used for long arguments have been
renamed and repositioned adhering to the general convention followed in
various other apps, like l3fwd.
Signed-off-by: Anoob Joseph <anoob.joseph@caviumnetworks.com> Acked-by: Radu Nicolau <radu.nicolau@intel.com>
Marko Kovacevic [Tue, 27 Mar 2018 12:14:30 +0000 (13:14 +0100)]
crypto/aesni_gcm: support IPsec Multi-buffer lib v0.49
Adds support for the v0.49 of the IPsec Multi-buffer lib,
which now gets compiled and installed as a shared object.
Therefore, there is no need to pass the AESNI_MULTI_BUFFER_LIB_PATH
Signed-off-by: Marko Kovacevic <marko.kovacevic@intel.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Marko Kovacevic [Tue, 27 Mar 2018 12:14:29 +0000 (13:14 +0100)]
crypto/aesni_mb: support IPsec Multi-buffer lib v0.49
Adds support for the v0.49 of the IPsec Multi-buffer lib,
which now gets compiled and installed as a shared object.
Therefore, there is no need to pass the AESNI_MULTI_BUFFER_LIB_PATH
Signed-off-by: Marko Kovacevic <marko.kovacevic@intel.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Tomasz Duszynski [Wed, 14 Mar 2018 13:12:54 +0000 (14:12 +0100)]
test/crypto: add MRVL to hash test cases
MRVL Crypto PMD supports most of the hash algorithms covered
by test suites thus specific bits should be set in pmd_masks.
Otherwise blockcipher authonly test returns success even though no
real tests have been executed.
Fixes: 84e0ded38ac5 ("test/crypto: add mrvl crypto unit tests") Cc: stable@dpdk.org Signed-off-by: Tomasz Duszynski <tdu@semihalf.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Fiona Trahe [Fri, 9 Mar 2018 17:44:38 +0000 (17:44 +0000)]
cryptodev: change argument of driver registration
Pass an rte_driver to the RTE_PMD_REGISTER_CRYPTO_DRIVER macro
rather than an unspecified container which holds an rte_driver.
All the macro actually needs is the rte_driver, not the
container holding it.
This paves the way for a later patch in which a driver
will be registered which does not naturally derive from a
container and so avoids having to create an arbitrary container
to pass in the rte_driver.
This patch changes the cryptodev lib macro and all the
PMDs which use it.
Maxime Coquelin [Wed, 14 Mar 2018 16:31:25 +0000 (17:31 +0100)]
vhost: deprecate unsafe GPA translation API
This patch marks rte_vhost_gpa_to_vva() as deprecated because
it is unsafe. Application relying on this API should move
to the new rte_vhost_va_from_guest_pa() API, and check
returned length to avoid out-of-bound accesses.
This issue has been assigned CVE-2018-1059.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Thu, 19 Apr 2018 08:52:33 +0000 (10:52 +0200)]
vhost/crypto: move to safe GPA translation API
This patch uses the new rte_vhost_va_from_guest_pa() API
to ensure all the descriptor buffer is mapped contiguously
in the application virtual address space.
It does not handle buffers discontiguous in host virtual
address space, but only return an error.
This issue has been assigned CVE-2018-1059.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Wed, 14 Mar 2018 15:46:46 +0000 (16:46 +0100)]
examples/vhost_scsi: move to safe GPA translation API
This patch uses the new rte_vhost_va_from_guest_pa() API
to ensure all the descriptor buffer is mapped contiguously
in the application virtual address space.
As the application did not checked return of previous API,
this patch just print an error if the buffer address isn't in
the vhost memory regions or if it is scattered. Ideally, it
should handle scattered buffers gracefully.
This issue has been assigned CVE-2018-1059.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Tue, 13 Mar 2018 18:43:48 +0000 (19:43 +0100)]
examples/vhost: move to safe GPA translation API
This patch uses the new rte_vhost_va_from_guest_pa() API
to ensure the application doesn't perform out-of-bound
accesses either because of a malicious guest providing an
incorrect descriptor length, or because the buffer is
contiguous in guest physical address space but not in the
host process virtual address space.
This issue has been assigned CVE-2018-1059.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Tue, 23 Jan 2018 13:37:50 +0000 (14:37 +0100)]
vhost: introduce safe API for GPA translation
This new rte_vhost_va_from_guest_pa API takes an extra len
parameter, used to specify the size of the range to be mapped.
Effective mapped range is returned via len parameter.
This issue has been assigned CVE-2018-1059.
Reported-by: Yongji Xie <xieyongji@baidu.com> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Tue, 23 Jan 2018 13:26:02 +0000 (14:26 +0100)]
vhost: check all range is mapped when translating GPAs
There is currently no check done on the length when translating
guest addresses into host virtual addresses. Also, there is no
guanrantee that the guest addresses range is contiguous in
the host virtual address space.
This patch prepares vhost_iova_to_vva() and its callers to
return and check the mapped size. If the mapped size is smaller
than the requested size, the caller handle it as an error.
This issue has been assigned CVE-2018-1059.
Reported-by: Yongji Xie <xieyongji@baidu.com> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
This patch fixes the size passed at the indirect descriptor
table translation time, which is the len field of the descriptor,
and not a single descriptor.
This issue has been assigned CVE-2018-1059.
Fixes: 62fdb8255ae7 ("vhost: use the guest IOVA to host VA helper") Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
git.droids-corp.org / dpdk.git / log